# last_role_administrator

The change would leave the organization with nobody able to grant roles (409).

## Meaning

Revoking a role, suspending or blocking an account would leave the organization with
no other active account holding `roles.assign`. The server refuses before changing
anything, so no organization is left without someone who can grant roles.

## Impact

Nothing changed. An owner trying to step down, or to suspend the only other owner,
sees this. It is expected and protects the organization from locking itself out.

## Diagnosis

Look the request id up on the Troubleshooting page. The refusal is recorded on the
action that was refused (`role.revoked`, `user.suspended` or `user.blocked`) with
reason `conflict` and cause `last_role_administrator`.

## Mitigation

- As an organization owner: grant `org-owner` to another active account first, then
  revoke or suspend.
- As an operator of the main organization: a platform owner can grant the role in
  the organization if no owner there is reachable.

## Escalation

Escalate when another active owner exists and the change is still refused. Open an
issue with the request id, the organization slug, the role ids involved and the
server version.

---

[Problem code runbooks](https://www.nauthera.io/docs/v1/runbooks/problems) · Generated from [`internal/runbook/problems.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/problems.yaml) in nauthera-server.